Google Updated Professional-Cloud-Security-Engineer Exam Questions and Answers by brian

Objective: Implement external web application protection and validate policy changes before enforcement.

Solution: Use Google Cloud Armor's preconfigured rules in preview mode.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the Google Cloud Armor section.

Step 3: Create or select a security policy.

Step 4: Apply preconfigured rules to the policy.

Step 5: Enable preview mode to simulate the effects of the rules without enforcing them.

Step 6: Monitor the logs to validate the policy changes.

Google Cloud Armor's preview mode allows you to test and validate the impact of security policies on your application traffic before applying them, ensuring that they work as intended without disrupting the service.

To ensure user-uploaded comments and product reviews do not include sensitive data before publication, use the Cloud Data Loss Prevention (DLP) API.

Enable DLP API:

Go to the Cloud Console and navigate to APIs & Services > Library.

Search for "Data Loss Prevention API" and enable it.

Configure DLP API:

Create an inspection template specifying the types of sensitive data to detect.

Set up de-identification templates if you want to redact or mask sensitive data.

Implement DLP in Application:

Use the Google Cloud DLP Client Library for the desired programming language.

Send the text data to the DLP API for inspection before saving or publishing.

from google.cloud import dlp_v2 dlp_client = dlp_v2.DlpServiceClient() parent = f"projects/{project_id}" item = {"value": "User comment text here"} inspect_config = {"info_types": [{"name": "PERSON_NAME"}, {"name": "CREDIT_CARD_NUMBER"}]} response = dlp_client.inspect_content(parent=parent, inspect_config=inspect_config, item=item)

Cloud Data Loss Prevention API Documentation

DLP API Client Libraries

This is a Customer-supplied encryption keys (CSEK). We generate our own encryption key and manage it on-premises. A KEK never leaves Cloud KMS.There is no KEK or KMS on-premises. Encryption at rest by default, with various key management options https://cloud.google.com/security/encryption-at-rest

To protect your web application from threats like malware by implementing TLS interception for incoming traffic, configuring a Secure Web Proxy with TLS offloading at the load balancer is an effective approach.​

Option A: By configuring a Secure Web Proxy, you can offload TLS traffic at the load balancer, inspect the decrypted traffic for threats such as malware, and then forward the inspected traffic to your web application. This approach ensures that encrypted traffic is securely analyzed without compromising the security of the data in transit.​

Option B: An internal proxy load balancer is designed for distributing traffic within a private network and may not support TLS interception capabilities required for inspecting incoming traffic from external sources.​

Option C: Hierarchical firewall policies in Google Cloud are used to enforce security rules across your organization but do not provide TLS interception capabilities.​

Option D: VPC firewall rules control traffic to and from VM instances based on specified rules but do not have the capability to perform TLS interception or traffic inspection.​

Therefore, Option A is the most suitable solution, as it allows for TLS interception through a Secure Web Proxy, enabling the inspection of incoming encrypted traffic to detect and mitigate threats like malware before the traffic reaches your web application.​